Resolution
What permissions does a user need to export GPOs to Active Directory from the Group Policy Administrator (GPA) Repository?
goal
What are the minimum permissions required to export GPOs to Active Directory from the GPA Repository?
fact
NetIQ Group Policy Administrator 4.x
fact
NetIQ Group Policy Administrator 5.0
fix
In 4.x versions of GPA, to export GPOs from the GP Repository to Active Directory, users need to be members of either the Domain Admins, Enterprise Admins, or Group Policy Creator Owners group in the domain to which they are exporting. In addition to this they must have export permissions on the GPO within the GP Repository. To assign users GPO export permissions in the GP Repository, use the Repository Security wizard and assign the GPO Exporter role to each user.
GPA 5.0 requires that a user be a member of the Domain Admins group in the target domain to export GPOs. The user must also have export permissions on the GPO in the GP Repository.
note
If you do not wish to grant these permissions to the GPA user in the Active Directory domain, you can use an export override account to perform the GPO exports. These Active Directory requirements would then apply to the export override account. For more information on enabling the export override account, see NETIQKB55380 .